That is odd; I don't see what purpose a DoS against a specific directory/node would serve (unless you were specifically attacking a connection routed through that node, or trying to use latency attacks). Is it an exit node? Could be retaliation from something a user did through your node by someone who doesn't understand tor, although choosing the directory port is a bit strange.
Another option would be that it's completely unrelated to tor. What port is your directory on? If it's a common service/proxy port, it could be some exploit attempt or similar getting confused. It's a bit worrying if someone cares about attacking tor itself that much, in an abstract way. Chances are it's nothing too worrisome, though. - John Brooks On Tue, Sep 2, 2008 at 7:20 AM, Scott Bennett <[EMAIL PROTECTED]> wrote: > A short time ago, I found that 212.205.53.212 had several hundred open > TCP connections to my tor server's DirPort, and very little relay traffic > seemed to be getting past all of that. I've now taken steps to prevent > such > connections from that IP address. (That IP address has the hame > sahrsmtp03.cosmote.gr.) Other tor server operators may (or may not) wish > to > follow suit. > > > Scott Bennett, Comm. ASMELG, CFIAG > ********************************************************************** > * Internet: bennett at cs.niu.edu * > *--------------------------------------------------------------------* > * "A well regulated and disciplined militia, is at all times a good * > * objection to the introduction of that bane of all free governments * > * -- a standing army." * > * -- Gov. John Hancock, New York Journal, 28 January 1790 * > ********************************************************************** >
